Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
26/04/2026, 05:10
General
- Target 2026-04-26_1ea3bfa52971cefabf8ae0fd03cc3d4e_cobalt-strike_icedid_satacom.exe
- Size 283KB
- Sample260426-ft8j3set5t
- SHA256 3c1bd44a092f6dff2102aafc5c82b20b464abd5f33e568049cecfd228b3d67d2
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-26_1ea3bfa52971cefabf8ae0fd03cc3d4e_cobalt-strike_icedid_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-26_1ea3bfa52971cefabf8ae0fd03cc3d4e_cobalt-strike_icedid_satacom.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsSecurityHealthService.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsSecurityHealthService.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
WindowsSecurityHealthService.exe
memory/1980-10-0x0000000140000000-0x0000000140034000-memory.dmp
memory/1980-1-0x00007FF9E2670000-0x00007FF9E2865000-memory.dmp
memory/1980-11-0x0000000140000000-0x0000000140034000-memory.dmp
memory/1980-0-0x00007FF70DA40000-0x00007FF70DA8B000-memory.dmp
memory/1980-9-0x0000000140000000-0x0000000140034000-memory.dmp
memory/1980-2-0x0000000140000000-0x0000000140034000-memory.dmp
memory/1980-12-0x0000000140000000-0x0000000140034000-memory.dmp
memory/1980-31-0x0000015252DF0000-0x0000015252DFC000-memory.dmp
memory/5040-30-0x00007FF7183E0000-0x00007FF71842B000-memory.dmp
memory/5040-17-0x00007FF9E2670000-0x00007FF9E2865000-memory.dmp
memory/5040-29-0x0000000140000000-0x0000000140034000-memory.dmp
memory/5040-28-0x0000000140000000-0x0000000140034000-memory.dmp
memory/5040-27-0x0000000140000000-0x0000000140034000-memory.dmp
memory/5040-25-0x0000000140000000-0x0000000140034000-memory.dmp
memory/5040-26-0x0000000140000000-0x0000000140034000-memory.dmp
memory/5040-16-0x00007FF7183E0000-0x00007FF71842B000-memory.dmp